Amendments to the Claims 

Claims pending: 

• At time of the Office Action: Claims 1-25, 27-31, 34-35, and 37-43. 

• After this Response: Claims 1-25, 27-31, 34-35, and 37-43. 
Canceled claims: None. 

Amended claims: None. 
New Claims: None. 



1. (Previously Amended) A computer-implemented method comprising: 
receiving a plurality of events; 

applying the plurality of events to a correlation function, wherein the 
correlation function is implemented as a state machine and is configured to 
correlate the plurality of events; 

identifying an event to which an update consumer has subscribed, wherein 
the update consumer is associated with the state machine; 

applying the update consumer to the state machine in response to the 
identified event; and 

generating a specific event if the correlation function is satisfied by the 
plurality of events. 

2. (Previously Amended) A method as recited in claim 1 wherein the 
update consumer is a class object. 
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3. (Original) A method as recited in claim 1 further including: 
receiving a data element; and 

applying the data element and at least one of the plurality of events to the 
correlation function. 

4. (Original) A method as recited in claim 1 further including: 
receiving a plurality of data elements; and 

applying the plurality of data elements and the plurality of events to the 
correlation function. 

5. (Original) A method as recited in claim 1 further including 
communicating the specific event to at least one event consumer that subscribed to 
the specific event. 

6. (Original) A method as recited in claim 1 further including continuing 
to receive additional events and apply the additional events to the correlation 
function if the correlation function is not satisfied by the plurality of events. 

7. (Original) A method as recited in claim 1 further including resetting the 
correlation function after generating a specific event. 



4 



8. (Original) A method as recited in claim 1 further including: 
creating an instance of a particular state machine; and 

defining transitions for the particular state machine by subscribing to at 
least one event. 

9. (Previously Amended) A method as recited in claim 8 further including 
deleting the instance of the particular state machine if the instance of the particular 
state machine reaches a final state. 

10. (Original) One or more computer-readable memories containing a 
computer program that is executable by a processor to perform the method recited 
in claim 1 . 

11. (Previously Amended) A computer-implemented method comprising: 
receiving a plurality of events; 

receiving a plurality of data elements; 

identifying a plurality of correlation functions configured to correlate the 
plurality of events and the plurality of data elements, wherein each correlation 
function is implemented with an associated state machine, and wherein each state 
machine has an associated update consumer that updates the state of the associated 
state machine; 

applying the plurality of events and the plurality of data elements to the 
plurality of correlation functions; and 
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1 generating a specific event if at least one of the plurality of correlation 

2 functions is satisfied. 

3 

4 12. (Previously Amended) A method as recited in claim 11 further 

5 comprising deleting a particular state machine when the particular state machine 

6 reaches a final state. 

7 

8 13. (Previously Amended) A method as recited in claim 11 wherein each 

9 update consumer is a class object. 

10 

11 14. (Original) A method as recited in claim 11 further including 

12 communicating the specific event to at least one event consumer that subscribed to 

13 receive the specific event. 

is 15. (Original) A method as recited in claim 1 1 further including: 

i6 receiving additional events; 

n receiving additional data elements; and 

is applying the plurality of events, the additional events, the plurality of data 

19 elements and the additional data elements to the plurality of correlation functions. 

20 

21 16. (Previously Amended) A method as recited in claim 11 further 

22 including: 

23 receiving additional events; 

24 receiving additional data elements; 

25 receiving additional correlation functions; and 



applying the plurality of events, the additional events, the plurality of data 
elements and the additional data elements to the plurality of correlation functions 
and the additional correlation functions. 

17. (Original) A method as recited in claim 16 further including 
generating the specific event if at least one of the plurality of correlation functions 
or at least one of the additional correlation functions is satisfied. 

18. (Original) A method as recited in claim 11 wherein the specific event 
generated is dependent on which correlation function is satisfied. 

19. (Original) One or more computer-readable memories containing a 
computer program that is executable by a processor to perform the method recited 
in claim 1 1 . 

20. (Previously Amended) A computer-implemented method comprising: 
identifying a schema for creating state machines, the state machines to 

correlate at least two events; 

creating an instance of a particular state machine; 

defining transitions for the particular state machine by subscribing to at 
least one event; and 

applying an update consumer to the particular state machine to update the 
state of the particular state machine, wherein the update consumer is a class object. 
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21. (Original) A method as recited in claim 20 further including deleting 
the particular state machine if the particular state machine reaches a final state. 

22. (Original) A method as recited in claim 20 wherein the particular state 
machine includes a timer, the method further including deleting the particular state 
machine if the timer expires. 

23. (Original) A method as recited in claim 20 wherein the particular state 
machine correlates at least one event and at least one data element. 

24. (Original) A method as recited in claim 20 wherein the particular state 
machine correlates a plurality of events and a plurality of data elements. 

25. (Original) A method as recited in claim 20 further including 
determining a current state of the particular state machine. 

26. (Canceled). 

27. (Original) One or more computer-readable memories containing a 
computer program that is executable by a processor to perform the method recited 
in claim 20. 



1 28. (Previously Amended) An apparatus comprising: 

2 a plurality of event consumers; and 

3 an event correlator coupled to the plurality of event consumers, the event 

4 correlator to receive events from at least one event source and to receive data 

5 elements from at least one data source, the event correlator further to receive at 

6 least one correlation function configured to correlate events and data elements and 

7 to apply the received events and the received data elements to the correlation 

8 function, wherein the correlation function is implemented by a state machine 

9 having an associated update consumer that updates the state of the state machine, 

10 and wherein the event correlator generates a specific event if the received events 

11 and the received data satisfy the correlation function. 

12 

13 29. (Original) An apparatus as recited in claim 28 wherein the event 

14 correlator communicates the specific event to the plurality of event consumers. 

15 

i6 30. (Original) An apparatus as recited in claim 28 wherein the event 

n correlator communicates the specific event to event consumers that have requested 

is to receive the specific event. 

19 

20 31. (Original) An apparatus as recited in claim 28 wherein the event 

21 correlator communicates the specific event to a plurality of filters, wherein each of 

22 the plurality of filters is associated with one of the plurality of event consumers. 

23 

24 32-33. (Canceled). 

25 
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1 34. (Original) An apparatus as recited in claim 28 wherein the event 

2 correlator continues to receive additional events and additional data elements and 

3 apply the additional events and the additional data elements to the correlation 

4 function. 

5 

6 35. (Previously Amended) One or more computer-readable media having 

7 stored thereon a computer program that, when executed by one or more 

8 processors, causes the one or more processors to: 

9 receive a plurality of events ; 

10 identify a plurality of correlation functions configured to correlate the 

11 plurality of events, wherein each of the plurality of correlation functions is 

12 implemented as a state machine having an associated update consumer; 

13 a Pply me plurality of events to the plurality of correlation functions to 

14 determine whether any of the plurality of correlation functions are satisfied by the 
is plurality of events, wherein the plurality of events are applied by causing update 
i6 consumers associated with each event to update the state of the associated state 
n machine; and 

is generate a specific event if one of the plurality of correlation functions is 

19 satisfied by the plurality of events. 

20 

21 36. (Canceled). 

22 

23 37. (Previously Amended) One or more computer-readable media as 

24 recited in claim 35 wherein each state machine is a class object. 

25 
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38. (Original) One or more computer-readable media as recited in claim 
37 further causing the one or more processors to identify a current state of the state 
machine. 

39. (Original) One or more computer-readable media as recited in claim 
35 further causing the one or more processors to: 

create a new instance of a state machine to implement a particular 
correlation function; and 

define transitions for the new instance of the state machine by subscribing 
to at least one event. 

40. (Previously Amended) A computer-implemented method comprising: 
receiving events from event providers; 

creating a first state machine; 
creating a second state machine; 

associating a first event type with the first state machine, wherein the first 
state machine has an associated first update consumer to update the state of the 
first state machine; 

associating a second event type with the second state machine, wherein the 
second state machine has an associated second update consumer to update the state 
of the second state machine; 

in response to receiving an event having a first event type, applying the first 
update consumer to the first state machine; 

in response to receiving an event having a second event type, applying the 
second update consumer to the second state machine; and 
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if the events are correlated: 

generating an additional event; and 

sending the additional event to an event consumer. 

41. (Previously Amended) The method as recited in claim 40, further 
comprising deleting the first state machine if the first state machine reaches a final 
state. 

42. (Previously Presented) The method as recited in claim 40, wherein the 
additional event is sent to the event consumer through a filter associated with the 
event consumer. 

43. (Previously Presented) The method as recited in claim 40, wherein the 
event consumer includes at least one of an event logging consumer, an event 
forwarding consumer, a mail consumer, and a scripting consumer. 
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